Splunk Search

Delete DB Connect indexed data

mavidales
Engager

I'm new to Splunk. Most of our logs are in databases. In testing out DB Connect I added some inputs and removed them later. However, the data that was indexed shows up in searches and I'd like to remove that also. Is there a command to do this? I would use splunk remove index <name> but i don't know the name of the index. There doesn't seem to be a command to remove data by source, or I haven't found it. There is other indexed data that I want to leave in place.

So how do I remove the indexes and data for those specific DB Connect inputs that were removed?

0 Karma
1 Solution

mavidales
Engager

Figured it out.

source="<yoursource>" | delete

Didn't know you could run those kinds of commands in the search bit. That's neat! Yay!

View solution in original post

0 Karma

mavidales
Engager

Figured it out.

source="<yoursource>" | delete

Didn't know you could run those kinds of commands in the search bit. That's neat! Yay!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Note, this does not clear up space but rather mark those events as deleted.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...